@indigoai-us/hq-cli 5.25.0 → 5.26.0

package/dist/utils/version-gate.js

@@ -0,0 +1,185 @@
+/**
+ * Hard version-gate: ask hq-pro whether the current CLI is below the minimum
+ * acceptable version and, if so, run `npm install -g …@latest` synchronously
+ * before any commander parsing happens. Distinct from the existing
+ * `version-check.ts` which is a passive (cached, opt-in) stderr nag against
+ * the npm registry.
+ *
+ * Why both?
+ *   - `version-check.ts` answers "is there something newer?" by polling npm
+ *     directly. It's a soft hint, lives on a 24h cache, and never blocks.
+ *   - `version-gate.ts` answers "is the team currently allowing your version
+ *     to run?" via an authoritative hq-pro endpoint. The server can yank a
+ *     known-bad release without waiting for the npm `latest` dist-tag move.
+ *
+ * The endpoint is reusable across clients (hq-sync, hq-installer, create-hq).
+ * See `apps/hq-pro/src/vault-service/handlers/client-version-check.ts` for the
+ * source-of-truth table.
+ *
+ * Trust model: anonymous. The CLI may be running pre-login (e.g. fresh
+ * install) so we never send credentials. The endpoint identifies the client
+ * by `clientId` + `currentVersion`.
+ *
+ * Failure mode: silent. Network down, hq-pro returning 5xx, malformed body —
+ * the gate must never break the CLI for a user who's otherwise fine. We log
+ * to Sentry as a breadcrumb (best-effort) and return.
+ *
+ * Opt-out: `HQ_NO_UPDATE_CHECK=1` (same env as `version-check.ts` — one knob
+ * to silence both check + gate).
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d7d58261-f0e4-56bc-b6eb-4117731744f9")}catch(e){}}();
+import { spawnSync } from "node:child_process";
+import chalk from "chalk";
+import { CLI_VERSION } from "../cli-version.js";
+import { DEFAULT_VAULT_API_URL } from "./cognito-session.js";
+const CLIENT_ID = "hq-cli";
+const ENDPOINT_PATH = "/v1/client-version/check";
+const FETCH_TIMEOUT_MS = 3_000;
+function isOptedOut() {
+    return process.env.HQ_NO_UPDATE_CHECK === "1";
+}
+/**
+ * Hit POST /v1/client-version/check. Returns the parsed body on 200, or
+ * `null` on any failure (caller treats as "no gate"). Tight 3s timeout —
+ * a hung server must not delay CLI startup.
+ */
+async function fetchVersionDecision() {
+    try {
+        const url = `${DEFAULT_VAULT_API_URL}${ENDPOINT_PATH}`;
+        const res = await fetch(url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json",
+            },
+            body: JSON.stringify({
+                clientId: CLIENT_ID,
+                currentVersion: CLI_VERSION,
+                platform: `${process.platform}-${process.arch}`,
+            }),
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        if (typeof body.minVersion !== "string" ||
+            typeof body.latestVersion !== "string" ||
+            typeof body.updateRequired !== "boolean") {
+            return null;
+        }
+        return body;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Run the upgrade command in a blocking subprocess. Inherits stdio so the
+ * user sees the npm progress. We do NOT auto-rerun the CLI on completion —
+ * forcing a re-invocation would run twice on the same process and feel
+ * janky; instead we print a clear "rerun your command" message and exit.
+ */
+function performUpdate(command) {
+    const parts = command.split(/\s+/).filter(Boolean);
+    if (parts.length === 0)
+        return { ok: false, detail: "empty command" };
+    const cmd = parts[0];
+    const args = parts.slice(1);
+    try {
+        const result = spawnSync(cmd, args, { stdio: "inherit" });
+        if (result.status !== 0) {
+            return {
+                ok: false,
+                detail: `exit ${result.status ?? "signal"}`,
+            };
+        }
+        return { ok: true };
+    }
+    catch (err) {
+        return { ok: false, detail: err instanceof Error ? err.message : String(err) };
+    }
+}
+/**
+ * Soft notify when the server says we're below `latestVersion` but still ≥
+ * `minVersion`. Single chalk-yellow line on stderr; never blocks.
+ */
+function nudgeUpdateRecommended(decision) {
+    const msg = chalk.yellow(`⚠ A new version of hq-cli is available: ${decision.latestVersion} (current: ${decision.currentVersion}).`);
+    console.error(msg);
+    if (decision.updateCommand) {
+        console.error(chalk.dim(`  Update: ${decision.updateCommand}`));
+    }
+}
+/**
+ * Hard enforcement when the server says we're below `minVersion`. Print a
+ * red banner, attempt the update, then exit so the user reruns against the
+ * fresh binary. Sequence chosen so a user with a broken `npm` global prefix
+ * still gets a clear error rather than an opaque silent failure.
+ *
+ * Exit codes:
+ *   0 — update succeeded; user must rerun their command
+ *   75 — update failed (EX_TEMPFAIL; common for sudo/EACCES on system npm)
+ */
+function enforceUpdateRequired(decision) {
+    const banner = chalk.red.bold(`✗ hq-cli ${decision.currentVersion} is below the minimum required version (${decision.minVersion}).`);
+    console.error(banner);
+    if (decision.message)
+        console.error(chalk.dim(`  ${decision.message}`));
+    const command = decision.updateCommand;
+    if (!command) {
+        console.error(chalk.red("  No updateCommand provided by hq-pro — see https://hq.indigo.ai/docs/cli-update for manual steps."));
+        if (decision.downloadUrl) {
+            console.error(chalk.dim(`  Download: ${decision.downloadUrl}`));
+        }
+        process.exit(75);
+    }
+    console.error(chalk.dim(`  Running: ${command}`));
+    const result = performUpdate(command);
+    if (!result.ok) {
+        console.error(chalk.red(`✗ Update failed${result.detail ? `: ${result.detail}` : ""}.`));
+        console.error(chalk.dim(`  Try manually: ${command}`));
+        process.exit(75);
+    }
+    console.error(chalk.green(`✓ Updated to hq-cli ${decision.latestVersion}. Rerun your command.`));
+    process.exit(0);
+}
+/**
+ * Public entry point. Call before commander parses argv. Blocks the CLI on
+ * network IO for up to FETCH_TIMEOUT_MS — acceptable because the alternative
+ * (a fire-and-forget background check) gives the user no chance to bail out
+ * of a known-bad version before it does damage.
+ *
+ * `--version` / `-v` callers MUST skip the gate (the user is debugging a
+ * broken install and shouldn't be force-upgraded mid-investigation). Caller
+ * is responsible for checking argv before invoking us — see index.ts.
+ */
+export async function enforceVersionGate() {
+    if (isOptedOut())
+        return;
+    const decision = await fetchVersionDecision();
+    if (!decision)
+        return; // best-effort: silent on any failure
+    if (decision.updateRequired) {
+        enforceUpdateRequired(decision); // exits process
+    }
+    if (decision.updateRecommended) {
+        nudgeUpdateRecommended(decision);
+    }
+}
+/**
+ * Cheap argv pre-check: skip the gate for `--version` / `-V` so users
+ * inspecting a broken install can still see what they have without being
+ * force-upgraded.
+ */
+export function shouldSkipGate(argv) {
+    return argv.some((a) => a === "--version" || a === "-V" || a === "-v" || a === "--help" || a === "-h");
+}
+export const __test__ = {
+    CLIENT_ID,
+    ENDPOINT_PATH,
+    FETCH_TIMEOUT_MS,
+    performUpdate,
+};
+//# sourceMappingURL=version-gate.js.map
+//# debugId=d7d58261-f0e4-56bc-b6eb-4117731744f9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.25.0",
+  "version": "5.26.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/dm.test.ts

@@ -0,0 +1,88 @@
+import { describe, it, expect } from "vitest";
+import { detectRecipient, parseDuration, buildDmBody } from "./dm.js";
+
+describe("detectRecipient", () => {
+  it("classifies an email", () => {
+    expect(detectRecipient("Stefan@Getindigo.ai")).toEqual({
+      toEmail: "stefan@getindigo.ai",
+    });
+  });
+  it("classifies a personUid", () => {
+    expect(detectRecipient("prs_01ABC")).toEqual({ toPersonUid: "prs_01ABC" });
+  });
+  it("rejects anything else", () => {
+    expect(detectRecipient("not-an-email")).toBeNull();
+    expect(detectRecipient("")).toBeNull();
+  });
+});
+
+describe("parseDuration", () => {
+  it("parses units", () => {
+    expect(parseDuration("30s")).toBe(30_000);
+    expect(parseDuration("10m")).toBe(600_000);
+    expect(parseDuration("2h")).toBe(7_200_000);
+    expect(parseDuration("1d")).toBe(86_400_000);
+    expect(parseDuration(" 5m ")).toBe(300_000);
+  });
+  it("returns null on garbage", () => {
+    expect(parseDuration("soon")).toBeNull();
+    expect(parseDuration("10")).toBeNull();
+    expect(parseDuration("10x")).toBeNull();
+  });
+});
+
+describe("buildDmBody", () => {
+  const now = Date.parse("2026-05-29T00:00:00.000Z");
+
+  it("builds an email DM with body", () => {
+    expect(
+      buildDmBody({ recipient: "a@b.com", message: "  hi  ", now }),
+    ).toEqual({ toEmail: "a@b.com", body: "hi" });
+  });
+
+  it("includes prompt + details when present, omits when blank", () => {
+    expect(
+      buildDmBody({
+        recipient: "prs_x",
+        message: "m",
+        prompt: "do the thing",
+        details: "  ",
+        now,
+      }),
+    ).toEqual({ toPersonUid: "prs_x", body: "m", prompt: "do the thing" });
+  });
+
+  it("resolves --in to a future deliverAt", () => {
+    const out = buildDmBody({ recipient: "a@b.com", message: "m", inDelay: "10m", now });
+    expect(out.deliverAt).toBe("2026-05-29T00:10:00.000Z");
+  });
+
+  it("resolves --at to a normalized ISO deliverAt", () => {
+    const out = buildDmBody({
+      recipient: "a@b.com",
+      message: "m",
+      at: "2026-06-01T12:00:00Z",
+      now,
+    });
+    expect(out.deliverAt).toBe("2026-06-01T12:00:00.000Z");
+  });
+
+  it("rejects an invalid recipient", () => {
+    expect(() => buildDmBody({ recipient: "nope", message: "m", now })).toThrow(/Invalid recipient/);
+  });
+
+  it("requires a body", () => {
+    expect(() => buildDmBody({ recipient: "a@b.com", message: "   ", now })).toThrow(/body is required/);
+  });
+
+  it("rejects both --at and --in", () => {
+    expect(() =>
+      buildDmBody({ recipient: "a@b.com", message: "m", at: "2026-06-01T12:00:00Z", inDelay: "10m", now }),
+    ).toThrow(/only one of --at or --in/);
+  });
+
+  it("rejects an invalid --at and --in", () => {
+    expect(() => buildDmBody({ recipient: "a@b.com", message: "m", at: "nope", now })).toThrow(/Invalid --at/);
+    expect(() => buildDmBody({ recipient: "a@b.com", message: "m", inDelay: "soon", now })).toThrow(/Invalid --in/);
+  });
+});

package/src/commands/dm.ts

@@ -0,0 +1,222 @@
+import { Command } from "commander";
+import chalk from "chalk";
+import { readFileSync } from "node:fs";
+import { ensureCognitoToken } from "../utils/cognito-session.js";
+import { vaultApiFetch } from "../utils/vault-api.js";
+
+const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
+const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
+
+export interface DmRecipient {
+  toEmail?: string;
+  toPersonUid?: string;
+}
+
+/**
+ * Classify a recipient arg as an email or a personUid. Mirrors the
+ * email/prs_ heuristic used by `hq members`. Returns null for neither.
+ */
+export function detectRecipient(recipient: string): DmRecipient | null {
+  const r = recipient.trim();
+  if (EMAIL_PATTERN.test(r)) return { toEmail: r.toLowerCase() };
+  if (PERSON_UID_PATTERN.test(r)) return { toPersonUid: r };
+  return null;
+}
+
+/**
+ * Parse a relative duration like `30s`, `10m`, `2h`, `1d` into milliseconds.
+ * Returns null on anything that doesn't match. Pure → unit-testable.
+ */
+export function parseDuration(input: string): number | null {
+  const m = /^(\d+)\s*(s|m|h|d)$/.exec(input.trim());
+  if (!m) return null;
+  const n = parseInt(m[1], 10);
+  const mult: Record<string, number> = {
+    s: 1000,
+    m: 60_000,
+    h: 3_600_000,
+    d: 86_400_000,
+  };
+  return n * mult[m[2]];
+}
+
+export interface DmSendBody {
+  toEmail?: string;
+  toPersonUid?: string;
+  body: string;
+  prompt?: string;
+  details?: string;
+  deliverAt?: string;
+}
+
+/**
+ * Build the POST /v1/notify/dm request body from CLI inputs. Pure (no I/O,
+ * no clock) so the option-resolution logic is unit-testable; the caller
+ * supplies `now` for the `--in` relative-delay computation.
+ *
+ * Throws Error with a user-facing message on invalid input.
+ */
+export function buildDmBody(args: {
+  recipient: string;
+  message: string;
+  prompt?: string;
+  details?: string;
+  at?: string;
+  inDelay?: string;
+  now: number;
+}): DmSendBody {
+  const rcpt = detectRecipient(args.recipient);
+  if (!rcpt) {
+    throw new Error(
+      `Invalid recipient '${args.recipient}': must be an email address or a personUid (prs_…).`,
+    );
+  }
+  const body = (args.message ?? "").trim();
+  if (!body) {
+    throw new Error("A message body is required: hq dm <recipient> <message>");
+  }
+
+  if (args.at && args.inDelay) {
+    throw new Error("Use only one of --at or --in, not both.");
+  }
+  let deliverAt: string | undefined;
+  if (args.at) {
+    const when = new Date(args.at);
+    if (isNaN(when.getTime())) {
+      throw new Error(`Invalid --at '${args.at}': must be an ISO8601 date.`);
+    }
+    deliverAt = when.toISOString();
+  } else if (args.inDelay) {
+    const ms = parseDuration(args.inDelay);
+    if (ms === null) {
+      throw new Error(
+        `Invalid --in '${args.inDelay}': use a relative delay like 30s, 10m, 2h, 1d.`,
+      );
+    }
+    deliverAt = new Date(args.now + ms).toISOString();
+  }
+
+  const prompt = args.prompt?.trim();
+  const details = args.details?.trim();
+
+  return {
+    ...rcpt,
+    body,
+    ...(prompt ? { prompt } : {}),
+    ...(details ? { details } : {}),
+    ...(deliverAt ? { deliverAt } : {}),
+  };
+}
+
+function friendlyDmError(status: number, code: string | undefined, fallback: string): string {
+  if (status === 401) return "Not authenticated — run `hq login` and try again.";
+  if (status === 404 || code === "RECIPIENT_NOT_FOUND") {
+    return "Recipient not found or not reachable — you can only DM someone you share an active company with.";
+  }
+  if (status >= 500) return `Server error: ${fallback}`;
+  return fallback;
+}
+
+export function registerDmCommand(program: Command): void {
+  program
+    .command("dm <recipient> [message]")
+    .description(
+      "Send a direct message to a teammate (email or personUid). They receive it as an HQ Sync notification.",
+    )
+    .option(
+      "--prompt <text>",
+      "Agent-context prompt the recipient can one-click copy into their agent",
+    )
+    .option("--prompt-file <path>", "Read the agent prompt from a file")
+    .option(
+      "--details <text>",
+      "Longer detail shown in the recipient's DM detail window",
+    )
+    .option("--details-file <path>", "Read the details from a file")
+    .option(
+      "--at <iso>",
+      "Schedule delivery at an ISO8601 time (store-and-forward; delivered within ~60s of the time)",
+    )
+    .option(
+      "--in <duration>",
+      "Schedule delivery after a relative delay: 30s, 10m, 2h, 1d",
+    )
+    .action(
+      async (
+        recipient: string,
+        message: string | undefined,
+        opts: {
+          prompt?: string;
+          promptFile?: string;
+          details?: string;
+          detailsFile?: string;
+          at?: string;
+          in?: string;
+        },
+      ) => {
+        try {
+          // Resolve prompt/details from inline text or a file.
+          let prompt = opts.prompt;
+          if (opts.promptFile) prompt = readFileSync(opts.promptFile, "utf8");
+          let details = opts.details;
+          if (opts.detailsFile) details = readFileSync(opts.detailsFile, "utf8");
+
+          const reqBody = buildDmBody({
+            recipient,
+            message: message ?? "",
+            prompt,
+            details,
+            at: opts.at,
+            inDelay: opts.in,
+            now: Date.now(),
+          });
+
+          const token = await ensureCognitoToken();
+          const res = await vaultApiFetch({
+            token,
+            path: "/v1/notify/dm",
+            method: "POST",
+            body: reqBody as unknown as Record<string, unknown>,
+          });
+
+          if (!res.ok) {
+            const err = (await res.json().catch(() => ({}))) as Record<string, string>;
+            console.error(
+              chalk.red(
+                friendlyDmError(res.status, err.code, err.error ?? err.message ?? res.statusText),
+              ),
+            );
+            process.exit(1);
+          }
+
+          const data = (await res.json()) as {
+            eventId?: string;
+            createdAt?: string;
+            scheduled?: boolean;
+            deliverAt?: string;
+          };
+
+          if (data.scheduled) {
+            console.log(
+              chalk.green(
+                `Scheduled DM to ${recipient} for ${data.deliverAt} (eventId ${data.eventId}).`,
+              ),
+            );
+            console.log(
+              chalk.dim("It delivers within ~60s of that time, even if you're offline."),
+            );
+          } else {
+            console.log(
+              chalk.green(`DM sent to ${recipient} (eventId ${data.eventId}).`),
+            );
+          }
+        } catch (err) {
+          console.error(
+            chalk.red("Error:"),
+            err instanceof Error ? err.message : String(err),
+          );
+          process.exit(1);
+        }
+      },
+    );
+}

package/src/commands/pkg-install.ts

@@ -21,7 +21,7 @@ import { execSync } from 'child_process';
 import { Command } from 'commander';
 import chalk from 'chalk';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
-import { findHqRoot } from '../utils/hq-root.js';
+import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
 import {
   getRegistryUrl,
   RegistryClient,
@@ -124,7 +124,7 @@ async function installPackage(
     }
 
     // 7. Extract
-    const hqRoot = findHqRoot();
+    const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
     const installDir = path.resolve(hqRoot, 'packages', 'installed', slug);
 
     // Clean existing installation

package/src/commands/pkg-list.ts

@@ -6,7 +6,7 @@
 
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { findHqRoot } from '../utils/hq-root.js';
+import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
 import { readRegistry } from '../utils/registry.js';
 import { loadCachedTokens, isExpiring } from '@indigoai-us/hq-cloud';
 import {
@@ -34,7 +34,7 @@ export function registerPackageListCommand(parent: Command): void {
 }
 
 async function listPackages(): Promise<void> {
-  const hqRoot = findHqRoot();
+  const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
   const installed = readRegistry(hqRoot);
 
   // Print installed packages

package/src/commands/pkg-remove.ts

@@ -10,7 +10,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { findHqRoot } from '../utils/hq-root.js';
+import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
 import { removeFromRegistry, readRegistry } from '../utils/registry.js';
 
 export function registerPackageRemoveCommand(parent: Command): void {
@@ -31,7 +31,7 @@ export function registerPackageRemoveCommand(parent: Command): void {
 }
 
 async function removePackage(slug: string): Promise<void> {
-  const hqRoot = findHqRoot();
+  const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
   const installDir = path.resolve(hqRoot, 'packages', 'installed', slug);
 
   // Verify it is actually installed

package/src/commands/pkg-update.ts

@@ -13,7 +13,7 @@ import { execSync } from 'child_process';
 import { Command } from 'commander';
 import chalk from 'chalk';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
-import { findHqRoot } from '../utils/hq-root.js';
+import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
 import {
   getRegistryUrl,
   RegistryClient,
@@ -43,7 +43,7 @@ export function registerPackageUpdateCommand(parent: Command): void {
 }
 
 async function updatePackages(slug?: string): Promise<void> {
-  const hqRoot = findHqRoot();
+  const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
   const entries = readRegistry(hqRoot);
 
   if (entries.length === 0) {

package/src/commands/team-sync.ts

@@ -16,7 +16,7 @@ import { execSync } from 'child_process';
 import { Command } from 'commander';
 import chalk from 'chalk';
 import simpleGit from 'simple-git';
-import { findHqRoot } from '../utils/hq-root.js';
+import { resolveDefaultHqRoot } from '../utils/cognito-session.js';
 import { ensureCognitoToken } from '../utils/cognito-session.js';
 
 // ─── Types ──────────────────────────────────────────────────────────────────
@@ -433,7 +433,7 @@ export function registerTeamSyncCommand(program: Command): void {
     .action(
       async (options: { team?: string; dryRun?: boolean }) => {
         try {
-          const hqRoot = findHqRoot();
+          const hqRoot = resolveDefaultHqRoot({ onMissing: 'throw' });
 
           // 1. Discover team directories
           let teamDirs = discoverTeamDirs(hqRoot);

package/src/index.ts

@@ -31,6 +31,7 @@ import { registerGroupsCommand } from "./commands/groups.js";
 import { registerFilesCommand } from "./commands/files.js";
 import { registerFilesBrowseCommands } from "./commands/files-browse.js";
 import { registerMembersCommand } from "./commands/members.js";
+import { registerDmCommand } from "./commands/dm.js";
 import { registerFeedbackCommand } from "./commands/feedback.js";
 import { registerMeetingsCommand } from "./commands/meetings.js";
 import { registerSourcesCommand } from "./commands/sources.js";
@@ -40,6 +41,10 @@ import {
   maybeWarnNewVersion,
   refreshVersionCache,
 } from "./utils/version-check.js";
+import {
+  enforceVersionGate,
+  shouldSkipGate,
+} from "./utils/version-gate.js";
 import { CLI_VERSION } from "./cli-version.js";
 
 // Swallow EPIPE when a downstream reader (e.g. `source <(…)`, `| head`) closes the pipe early.
@@ -134,6 +139,7 @@ registerFilesBrowseCommands(filesCmd);
 
 // Membership management (subcommand group — hq members invite|list|revoke)
 registerMembersCommand(program);
+registerDmCommand(program);
 
 // Onboarding (top-level — Cognito + vault-service provisioning)
 registerOnboardCommand(program);
@@ -157,6 +163,14 @@ registerSignalsCommand(program);
       message: sanitizeArgv(process.argv.slice(2)).join(" "),
       level: "info",
     });
+    // Hard version gate: ask hq-pro whether this CLI is below the floor and
+    // auto-update if so (exits the process on update). Skipped for inspection
+    // flags (`--version`, `--help`) so users debugging a broken install can
+    // still introspect what they have. Silent on any failure — never blocks
+    // the CLI on a flaky network or hq-pro hiccup. See `utils/version-gate.ts`.
+    if (!shouldSkipGate(process.argv)) {
+      await enforceVersionGate();
+    }
     await program.parseAsync();
   } catch (err) {
     Sentry.captureException(err);